unjwt 0.5.22 → 0.5.24

package/README.md

@@ -603,18 +603,18 @@ console.log(rsaPublicSpki);
 
 ### Adapters
 
-#### H3 (Nuxt, Nitro)
+#### H3 v1 (Nuxt v4, Nitro v2)
 
-The `h3` adapter bundles session helpers that store data inside signed or encrypted JWTs.
+The `h3v1` adapter bundles session helpers that store data inside signed or encrypted JWTs.
 
 - `useJWESession(event, config)` encrypts the session payload with the provided `secret` (password string or private/symmetric JWK). Use this when session data must remain confidential. (cookie's `httpOnly: true` by default)
 - `useJWSSession(event, config)` signs, but does not encrypt, the session payload with `config.key`. Use this when clients may read the session content but you still need tamper protection. (cookie's `httpOnly: false` by default)
 
-Both helpers expose the same API: read `session.id` / `session.data`, call `session.update()` to patch values, and `session.clear()` to invalidate the cookie. When setting `maxAge`, `exp` claim is automatically managed and validated.
+Both helpers expose the same API: read `session.id` / `session.data`, call `session.update()` to patch values, and `session.clear()` to invalidate the cookie. When setting `maxAge`, `exp` claim is automatically managed and validated. They also support a number of `hooks` in the config for custom logic (e.g. logging, refreshing, etc).
 
 ```ts
 import { defineEventHandler } from "h3";
-import { useJWESession, useJWSSession, generateJWK } from "unjwt/adapters/h3";
+import { useJWESession, useJWSSession, generateJWK } from "unjwt/adapters/h3v1";
 
 const keys = await generateJWK("RS256");
 
@@ -641,6 +641,121 @@ export default defineEventHandler(async (event) => {
 });
 ```
 
+#### H3 v2 (Nuxt v5, Nitro v3)
+
+The `h3v2` adapter bundles session helpers that store data inside signed or encrypted JWTs.
+
+- `useJWESession(event, config)` encrypts the session payload with the provided `secret` (password string or private/symmetric JWK). Use this when session data must remain confidential. (cookie's `httpOnly: true` by default)
+- `useJWSSession(event, config)` signs, but does not encrypt, the session payload with `config.key`. Use this when clients may read the session content but you still need tamper protection. (cookie's `httpOnly: false` by default)
+
+Both helpers expose the same API: read `session.id` / `session.data`, call `session.update()` to patch values, and `session.clear()` to invalidate the cookie. When setting `maxAge`, `exp` claim is automatically managed and validated. They also support a number of `hooks` in the config for custom logic (e.g. logging, refreshing, etc).
+
+```ts
+import { H3, HTTPError, serve } from "h3v2";
+
+import {
+  type SessionConfigJWE,
+  type SessionConfigJWS,
+  useJWESession,
+  useJWSSession,
+  getJWESession,
+  updateJWSSession,
+  generateJWK,
+} from "unjwt/adapters/h3v2";
+
+const atJwk = await generateJWK("RS256");
+
+const jweOptions = {
+  key: "refresh_token_secret",
+  name: "refresh_token",
+} satisfies SessionConfigJWE;
+
+const jwsOptions = {
+  key: atJwk,
+  name: "access_token",
+  maxAge: 15 * 60, // 15 minutes
+  hooks: {
+    async onExpire(event, _error, config) {
+      const refreshSession = await getJWESession(event, jweOptions);
+      if (!refreshSession.data.sub) {
+        // no valid refresh session, nothing to do
+        return;
+      }
+
+      console.log("Access token expired, refreshing...");
+
+      // refresh the access token
+      await updateJWSSession(event, config, {
+        sub: refreshSession.data.sub,
+        scope: refreshSession.data.scope,
+      });
+    },
+  },
+} satisfies SessionConfigJWS;
+
+const app = new H3();
+
+app.post("/login", async (event) => {
+  const refreshSession = await useJWESession(event, jweOptions);
+  const accessSession = await useJWSSession(event, jwsOptions);
+
+  if (accessSession.data.sub) {
+    // user already logged in, return existing info
+    return {
+      accessToken: {
+        id: accessSession.id,
+        createdAt: accessSession.createdAt,
+        expiresAt: accessSession.expiresAt,
+        data: accessSession.data,
+      },
+      refreshSession: {
+        id: refreshSession.id,
+        createdAt: refreshSession.createdAt,
+        expiresAt: refreshSession.expiresAt,
+        data: refreshSession.data,
+      },
+    };
+  }
+
+  const data = (await event.req.json()) as {
+    username?: string;
+    password?: string;
+  };
+
+  if (!data.username || !data.password) {
+    throw new HTTPError("Username and password are required", { status: 400 });
+  }
+
+  // validate user credentials here
+
+  const claims = {
+    sub: data.username,
+    scope: ["read:profile"],
+  };
+
+  await accessSession.update(claims);
+
+  await refreshSession.update(claims);
+
+  return {
+    accessToken: {
+      id: accessSession.id,
+      createdAt: accessSession.createdAt,
+      expiresAt: accessSession.expiresAt,
+      data: accessSession.data,
+    },
+    refreshSession: {
+      id: refreshSession.id,
+      createdAt: refreshSession.createdAt,
+      expiresAt: refreshSession.expiresAt,
+      data: refreshSession.data,
+    },
+  };
+});
+
+serve(app);
+```
+
 ---
 
 ### Utility Functions

package/dist/{h3.d.mts → adapters/h3.d.mts}

@@ -1,15 +1,15 @@
-import { b as JWEEncryptOptions } from './shared/unjwt.9mL1vSFP.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.9mL1vSFP.mjs';
-import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from './shared/unjwt.CtHrClHc.mjs';
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
+import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
 import { CookieSerializeOptions } from 'cookie-es';
 import { H3Event } from 'h3';
-import { c as JWSSignOptions } from './shared/unjwt.BsLgL0DQ.mjs';
-export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from './shared/unjwt.BjP_dGnX.mjs';
+import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
@@ -24,11 +24,11 @@ interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
     [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
 }
 interface SessionHooksJWE {
-    onRead?: (session: SessionJWE, event: H3Event) => void | Promise<void>;
-    onUpdate?: (session: SessionJWE, event: H3Event) => void | Promise<void>;
-    onClear?: (event: H3Event) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined) => void | Promise<void>;
-    onError?: (event: H3Event, error: any) => void | Promise<void>;
+    onRead?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
+    onUpdate?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
+    onClear?: (event: H3Event, config: Partial<SessionConfigJWE>) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
+    onError?: (event: H3Event, error: any, config: SessionConfigJWE) => void | Promise<void>;
 }
 interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     readonly id: string | undefined;
@@ -39,8 +39,13 @@ interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     clear: () => Promise<SessionManager<T>>;
 }
 interface SessionConfigJWE {
-    /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
-    secret: string | JWK_Symmetric | {
+    /** @deprecated use `key` instead */
+    secret?: string | JWK_Symmetric | {
+        privateKey: JWK_Private | JWK_Symmetric;
+        publicKey?: JWK_Public;
+    };
+    /** Shared key used, string for PBES2 or Json Web Key (JWK) */
+    key: string | JWK_Symmetric | JWK_Private | {
         privateKey: JWK_Private | JWK_Symmetric;
         publicKey?: JWK_Public;
     };
@@ -52,8 +57,6 @@ interface SessionConfigJWE {
     cookie?: false | CookieSerializeOptions;
     /** Default is x-h3-session / x-{name}-session */
     sessionHeader?: false | string;
-    /** Optional WebCrypto implementation override */
-    crypto?: Crypto;
     /** Default is crypto.randomUUID */
     generateId?: () => string;
     /** JWE configuration overrides */
@@ -111,7 +114,7 @@ declare function clearJWESession(event: H3Event, config: Partial<SessionConfigJW
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
@@ -125,11 +128,11 @@ interface SessionJWS<T extends SessionDataT = SessionDataT> {
     [kGetSessionPromise]?: Promise<SessionJWS<T>>;
 }
 interface SessionHooksJWS {
-    onRead?: (session: SessionJWS, event: H3Event) => void | Promise<void>;
-    onUpdate?: (session: SessionJWS, event: H3Event) => void | Promise<void>;
-    onClear?: (event: H3Event) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined) => void | Promise<void>;
-    onError?: (event: H3Event, error: any) => void | Promise<void>;
+    onRead?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
+    onUpdate?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
+    onClear?: (event: H3Event, config: Partial<SessionConfigJWS>) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
+    onError?: (event: H3Event, error: any, config: SessionConfigJWS) => void | Promise<void>;
 }
 interface SessionConfigJWS {
     /**
@@ -147,8 +150,6 @@ interface SessionConfigJWS {
     cookie?: false | CookieSerializeOptions;
     /** Custom header (false to disable header lookup) */
     sessionHeader?: false | string;
-    /** Provide a custom WebCrypto (if needed for algorithm operations) */
-    crypto?: Crypto;
     /** Custom ID generator (defaults to crypto.randomUUID) */
     generateId?: () => string;
     /** JWS customization */